Description:
------------
Running PHP version 5.2.2, I can consistently crash php (cli) with a

*** glibc detected *** corrupted double-linked list

Verified permissions to all files and paths.
Running Openldap 2.3.

The test code below should reproduce the error without fail.  I've verified the same operations against Openldap with a client written in C and this error does not occur.  I'll apologize ahead of time for any mis-spellings since I've had to retype the entire backtrace by hand.

Reproduce code:
---------------
<?php

$host = "ldap://host.domain.com";
$tls_cacert = "/etc/openldap/cacerts/cacert.pem";
$tls_cert = "/etc/openldap/certificates/ldap-client.pem";
$tls_key = "/etc/openldap/certificates/ldap-client-key.pem";

putenv("LDAPTLS_CACERT=$tls_cacert");
putenv("LDAPTLS_CERT=$tls_cert");
putenv("LDAPTLS_KEY=$tls_key");

$result = ldap_set_option(NULL, LDAP_OPT_PROTOCOL_VERSION, 3);
if(!$result) {
exit(0);
}

$conn = ldap_connect($host);

if(!conn) {
exit(0);
}

$result = ldap_start_tls($conn);

if(!result) {
exit(0);
}
?>

Expected result:
----------------
A clean exit.

Actual result:
--------------
(gdb) run test.php
.....
[New Tread -1208449344 (LWP 10103)]
*** glibc detected *** corrupted double-linked list: 0x09e63d0 ***

Program received signal SIGABRT, Aborted.
[Switching to Thread -1208449344 (LWP 10103)]
0x0061b7a2 in _dl_sysinfo_int80 () from /lib/ld-linux.so.2
(gdb) bt
#0 	0x0061b7a2 in _dl_sysinfo_int80
...
#5 	0x0016333a in free() from /lib/tls/libc.so.6
#6 	0x006f8cf2 in CRYPTO_free() from /lib/libcrypto.so.4
#7 	0x00753213 in X509_CINF_free() from /lib/libcrypto.so.4
#8 	0x00758003 in ASN1_primitive_free () from /lib/libcrypto.so.4
#9 	0x007581d3 in ASN1_item_free () from /lib/libcrypto.so.4
#10 	0x00753311 in X509_free() from /lib/libcrypto.so.4
#11	0x00ba353e in ssl_cert_free () from /lib/libssl.so.4
#12	0x00ba11c7 in SSL_CTX_free() from /lib/libssl.so.4
#13	0x009b0e13 in ldap_pvt_tls_init_def_ctx () from /usr/lib/libldap-2.3.so.0
#14	0x009b113e in ldap_pvt_tls_init_def_ctx () from /usr/lib/libldap-2.3.so.0
#15	0x009b1482 in ldap_int_tls_start () from /usr/lib/libldap-2.3.so.0
#16	0x009b1bbc in ldap_start_tls_s () from /usr/lib/libldap-2.3.so.0
#17	0x080f36b2 in zif_ldap_start_tls (ht=1, return_value=0xb7f53120, return_value_ptr=0x0, this_ptr=0x0, return_value_used=1) at /usr/src/debug/php-5.2.2/ext/ldap/ldap.c:2110
#18	0x08255321 in zend_do_fcal_common_helper_SPEC (execute_data=0xbff90b20) at /usr/src/debug/php-5.2.2/Zend/zend_vm_execute.h:200
#19	0x08254a99 in execute (op_array=0xb7f520f8) at /usr/src/debug/php-5.2.2/Zend/zend_vm_execute.h:92
#20	0x0823b8d9 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /usr/src/debug/php-5.2.2/Zend/zend.c:1134
#21	0x08202f29 in php_execute_script (primary_file=0xbff92f80) at /usr/src/debug/php-5.2.2/main/main.c:1794
#22	0x082b619e in main (argc=2, argv=0xbff93054) at /usr/src/debug/php-5.2.2/sapi/cli/php_cli.c:1130